The invention relates generally to systems and methods for authenticating a user, and more specifically, to a system and method for authenticating a user utilizing a web browser toolbar one time password (OTP) token. The invention also relates to a system and method for preventing the OTP values (time based, counter based, event-based, challenge-response or other forms of one time passwords) from being submitted to a non-trusted web site.
Many institutions provide some form of Internet access for their customers. Online banking and online shopping are well-known examples, although there are many other models for using Internet access as part of overall client interaction. To provide such access an institution typically creates an account for the customer, and gives the customer a username and static password associated with the account.
Static passwords have some security weaknesses. For example, if a static password is compromised it remains compromised, because by definition it does not change. Dynamic passwords (for example OTPs and passwords that are provided on behalf of the user by either a hardware or software device) may be used to mitigate the problems associated with a static password. Since dynamic passwords are designed to change, a compromise only lasts for a finite time, i.e., until the dynamic password is updated.
Discrete devices and software modules exist to generate and display dynamic passwords such as OTPs. However, such devices and software modules typically require significant user assistance to submit the OTP to an entity requesting the OTP for an authentication operation. Further, such devices or software modules do not afford any safeguards against submitting the dynamic password to an unauthorized recipient.